Customers were charged fees ranging from $7.99 to $11.99 per month for such services without providing Chase authorization to enroll them, and in many cases they weren’t receiving all of the monitoring and protection services they were paying for, the agency says.

Some customers paid for years — as far back as 2005 — without a clue, the Los Angeles Times says.

The bank was ordered to refund $309 million to more than 2.1 million customers, the CFPB says. Chase has already done so: Consumers should have received refunds as an account credit or a check by December of last year.

It’s a good thing, too, because the bank now owes regulators a lot more money. On top of the refunds, Chase owes a $20 million penalty to the CFPB’s Civil Penalty Fund and $60 million in penalties to the U.S. Office of the Comptroller of the Currency, the CFPB says.

Meanwhile, in other Chase news, McClatchy reported:

Also Thursday, British and American regulators announced that JPMorgan Chase & Co. had admitted wrongdoing and agreed to pay nearly $1 billion in penalties for unsafe derivatives trading practices that resulted in $6 billion in losses for the bank in 2012, a debacle nicknamed “The London Whale.”

In another enforcement action Thursday, the company received a cease-and-desist order from the U.S. Office of the Comptroller of the Currency for using improper procedures to collect debt from customers of its credit card, auto-lending and student-lending services, as well as from military service members.